How do you stop a package from being upgraded on Debian or Ubuntu?
Use sudo apt-mark hold package to freeze it at the current version and apt-mark unhold to release it. For finer control, such as preferring a specific version or repository, use APT pinning in /etc/apt/preferences.d/.
Explain it simply
Sometimes an upgrade would break your app: a new database or Node version may behave differently. You want to keep one package fixed while everything else updates, like skipping one app in your phone's auto-update.
sudo apt-mark hold postgresql-15 marks the package as held. apt upgrade will skip it and report it as "kept back". apt-mark showhold lists all held packages, and sudo apt-mark unhold postgresql-15 removes the hold.
To install a specific older version: apt-cache policy nginx shows available versions, then sudo apt install nginx=1.18.0-6ubuntu14.
Pinning is the more detailed tool. A file in /etc/apt/preferences.d/ can give a repository or version a priority number. A higher priority than the default of 500 makes apt prefer it, and a value of -1 blocks it.
On Red Hat systems, the equivalent is dnf versionlock add package from the versionlock plugin.
Example
sudo apt-mark hold nginx
apt-mark showhold
# nginx
sudo apt upgrade # nginx is kept back
sudo apt-mark unhold nginxWhat to say in the interview
"apt-mark hold freezes a package at its current version, and unhold releases it. For specific versions I check apt-cache policy and install name=version, and use pin files for repository-level preferences. Holds should be temporary and documented."
Common mistakes
- Leaving held packages forever and missing security updates.